Anti-DDoS:Add a Sec-MCA rule

Background

Sec-MCA lines are designed to protect service traffic only from carriers in the Chinese mainland. To protect all of your service traffic, you must use Sec-MCA with an Anti-DDoS Proxy instance (outside the Chinese mainland) that has Insurance or Unlimited protection. This topic uses an example architecture that combines Sec-MCA 2.0 and an Anti-DDoS Proxy instance (outside the Chinese mainland) with Unlimited protection. This setup routes traffic as follows:

• Traffic from carriers such as China Telecom, China Unicom, and China Mobile in the Chinese mainland is routed to the IP address of the Sec-MCA 2.0 instance.

• All other traffic is routed to the IP address of the Anti-DDoS Proxy instance (outside the Chinese mainland) with Unlimited protection.

Limitations

Sec-Traffic Manager cannot automatically schedule traffic for services that are accessed directly by their IP addresses.

Procedure

1. Add your website to both an Anti-DDoS Proxy instance (outside the Chinese mainland) with Unlimited protection and a Sec-MCA 2.0 instance. Then, ensure that traffic is forwarded correctly.

   • For information about access configuration, see Add a website configuration or Configure port forwarding rules.

     Note

     Configure only service access. Do not modify DNS resolution settings yet.

   • To verify that traffic is forwarded correctly, see Verify traffic forwarding settings on a local machine.

2. Configure a Sec-MCA rule.

   1. Log on to the Anti-DDoS Proxy console.

   2. In the top menu bar at the upper left corner, choose the Outside Chinese Mainland region.

      If you select this region, you are redirected to the Anti-DDoS Proxy (Outside Chinese Mainland) console.

   3. In the left-side navigation pane, choose Onboarding > Sec-Traffic Manager.

   4. On the General Interaction tab, click Add Rule, configure the interaction rule, and then click Next.

      Parameter	Description
      Interaction Scenario	Select Sec-CMA.
      Rule Name	A rule name can contain only letters, numbers, and underscores (_) and must be 128 characters or less.
      Sec-CMA	Select the IP address of the Sec-MCA instance.
      Anti-DDoS Proxy (Outside Chinese Mainland)	Select the IP address of the Anti-DDoS Proxy instance with Unlimited protection.

      After you add the rule, Sec-Traffic Manager generates a CNAME address for the rule. The new rule and its CNAME address appear in the rule list.

3. Modify the DNS record configuration: Follow the on-screen instructions to modify your DNS record configuration. This ensures that the interaction rules for Sec-Traffic Manager take effect.

   1. Validate in your local environment: Before you modify public DNS records, simulate the record change by modifying the hosts file on your local computer. This lets you validate the scheduling rules and prevent incompatibility issues caused by inconsistent back-to-origin policies. The following is a typical risk scenario:

      Note

      For more information about how to validate scheduling rules, see Locally validate your forwarding configuration.

      • Scenario: CDN, Anti-DDoS, and OSS used in combination

      • Potential conflict:

        • CDN: Allows you to customize the Configure default origin host. This allows CDN to correctly identify OSS buckets.

        • Anti-DDoS: Does not typically support modifying the back-to-origin HOST. It uses the Host header from the request by default.

      • Symptom: When an attack triggers an automatic switchover to Anti-DDoS, the Host header forwarded by Anti-DDoS does not match the header that OSS expects. As a result, OSS cannot identify normal traffic, and service access fails.

   2. Modify the DNS record: After you complete and confirm the local validation, modify the DNS record for your domain name to point to the CNAME address provided by Sec-Traffic Manager. Choose the operation path based on your domain name registrar:

      Domain name registrar	Instructions
      Alibaba Cloud	Log on to the Alibaba Cloud DNS console to make the change.
      Third-party platform	Log on to the management console of your third-party registrar and modify the DNS record for the domain name.

   3. Verify the result: After you modify the DNS record, use a browser to test whether the website is accessible.

      Note

      • After the modification is complete, the rule may take some time to take effect because of the Time to Live (TTL) of the DNS record. For more information, see Modify a CNAME record for Traffic Scheduler.

      • If the website is inaccessible, troubleshoot the issue. For more information, see Troubleshoot slow response, high latency, and access failures for services protected by Anti-DDoS Proxy.

Related operations

After you add a General Interaction rule, you can perform the following operations on rules in the rule list.